aws-memorydb-cluster-exposes-acl-credentials

Cluster's ACL contains users (credentials); the cluster exposes those credentials to authenticated network access.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Cache`
target type	`Credential`
source	`?cluster`
target	`?aclUser`
state logic	ACTIVE — the cluster structurally contains the ACL user (Credential node). The credential authenticates to the cluster; therefore the cluster "exposes" the credential to anyone who obtains password knowledge and network reach.

source type

Cache

target type

Credential

source

?cluster

target

?aclUser

state logic

ACTIVE — the cluster structurally contains the ACL user (Credential node). The credential authenticates to the cluster; therefore the cluster "exposes" the credential to anyone who obtains password knowledge and network reach.

Narrative

{cluster.name} is associated with ACL users ({aclUser.name}); the cluster exposes these wire-protocol credentials to any network-reachable entity that can authenticate with the user's password.

Raw rule rules/derived/aws/memorydb.yaml

id: aws-memorydb-cluster-exposes-acl-credentials
emits: ExposesCredential
description: Cluster's ACL contains users (credentials); the cluster exposes those credentials to authenticated
  network access.
match:
- - cluster: null
  - Contains
  - aclUser: null
where:
- node_type(?cluster) == Cache
- ?cluster.provider == 'aws'
- node_type(?aclUser) == Credential
- ?aclUser.provider_type == 'memorydb_acl_user'
emit:
  source_type: Cache
  target_type: Credential
  source: ?cluster
  target: ?aclUser
  conditions: []
  state_logic: "ACTIVE \u2014 the cluster structurally contains the ACL user (Credential node). The credential\
    \ authenticates to the cluster; therefore the cluster \"exposes\" the credential to anyone who obtains\
    \ password knowledge and network reach."
  confidence: contributing_confidences[0]
  derived_from:
  - '<Contains edge_id: ?cluster -> ?aclUser>'
  false_positive_note: 'This rule is a structural promotion: it derives ExposesCredential from the explicit
    Contains relationship. Emit whenever Contains(cluster, aclUser) is observed. The actual risk (CanReadData)
    is derived downstream by rules that match on both ExposesCredential and CanNetworkReach.'
  narrative: '{cluster.name} is associated with ACL users ({aclUser.name}); the cluster exposes these
    wire-protocol credentials to any network-reachable entity that can authenticate with the user''s password.'